Google Workspace

Google Workspace is the primary identity and collaboration platform. This page covers how the nomenclature maps to Workspace constructs.

Groups

Every group type in our nomenclature maps to a Google Group with specific settings. See the Groups section for the full taxonomy. The key Workspace-specific details:

Creation Procedure

Follow the Admin UI order: Group Information → Access Settings → Security Settings.

1. Group Information: Set email, name, description per canonical patterns.
2. Access Settings: Configure posting, membership, viewing per group type.
3. Security Settings: Set CEL restrictions, allowlists, and Locked status.

Labels

• Mailing: ON for all groups.
• Security (irreversible): ON for Dept/Team/Role groups. OFF for Mail/Intake/Alerts/Infra/People/Ident.
• Locked: ON if automation manages membership/settings.

Description Trailers

Every group description ends with exactly one of:

• Security group ({concise purpose})
• Non-security group ({concise purpose})
• Optionally: Locked group ({reason})

Shared Drives

Drive Naming Convention

{INT|EXT}_{ORG}_{Purpose}_{Channel}_{State}_{Sensitivity}

Component	Values
Visibility	INT (internal), EXT (external-safe)
Org	PRV, OCS, PQX, etc.
Purpose	Customers-{CusPascal}, Marketing, Operations, etc.
Channel	COLLAB, TEAM, STRICT, ARCH
State	Active, Archived
Sensitivity	Public, Private, Confidential, Restricted

Examples

EXT_PRV_Customers-SlopeClinical_COLLAB_Active_Private
INT_PRV_Customers-SlopeClinical_TEAM_Active_Private
INT_PRV_Customers-SlopeClinical_STRICT_Active_Confidential
INT_PRV_Marketing_TEAM_Active_Private
INT_PRV_Security_STRICT_Active_Restricted

Thin Root Rule

Every drive root is a thin root — navigation and admin only, no working content. Standard root files:

• README.md
• INDEX.md
• CHANGELOG.md
• _shared/
• 00_inbox/

OUs (Organizational Units)

OUs define policy buckets (device posture, session length, DLP rules). They never grant access. See People & Identity for the full OU tree.

Root Defaults

Applied tenant-wide unless overridden:

• 2-Step Verification: Required (FIDO2 preferred)
• Sessions: 8-12h default
• Mail: IMAP/POP off, auto-forward off, external banners on
• OAuth/Marketplace: Restricted/allowlist
• Logging: Admin, Drive, DLP, Vault exports enabled

GAM Automation

GAM (Google Apps Manager) is used for bulk operations. Common patterns:

Create a Group

ORG="prv"
DOMAIN="provisionr.com"

EMAIL="${ORG}-eng-team-apps@${DOMAIN}"
NAME="PRV – Team – Engineering – Apps"
DESC="${NAME}: Application delivery & features | App engineers | Repos, pipelines, code quality | Security group (internal team coordination)"

gam create group "${EMAIL}" name "${NAME}" description "${DESC}"
gam update group "${EMAIL}" settings securitylabel on

Nest a Team into a Department

gam update group "${ORG}-eng-dept@${DOMAIN}" add member "${ORG}-eng-team-apps@${DOMAIN}"

Audit Group Ownership

# Find groups with fewer than 2 owners
gam print group-members type owner | awk -F',' '{count[$1]++} END{for(g in count) if(count[g]<2) print g, count[g]}'

Export Drive Permissions

gam print drivefileacls query "name contains 'PRV'" fields id,emailaddress,role,type

Quarterly Review Checklist

• All groups have >= 2 owners
• Security labels match group type (ON for Dept/Team/Role, OFF for pipes)
• No externals on TEAM or STRICT drives
• OAuth/Marketplace allowlists are current
• OU policies match canonical settings
• Description trailers are present and correct
• Archive is ON for all mail pipe groups